UNITED STATES DISTRICT COURT 
EASTERN DISTRICT OF TENNESSEE 


ECOLAB Inc., and NALCO COMPANY, LLC 
d/b/a Nalco Water, an Ecolab Company and/or 


Nalco Water, 
Case No. 1:22-cv-00050-TRM-SKL 


Plaintiffs, ; 
Hon. Travis McDonough 


V. 
Magistrate Judge Susan K. Lee 
ANTHONY RIDLEY, and CHEMTREAT, 
INC., 


Defendants. 


CHEMTREAT’S MEMORANDUM IN SUPPORT OF MOTION 
TO EXCLUDE CERTAIN OPINIONS OF LAURENCE D. LIEB 


Case 1:22-cv-00050-TRM-SKL Document 258 Filed 05/25/23 Page 1of30 PagelD #: 6514 


TABLE OF CONTENTS 


TABLE-OF AW THOR DUIES sss sacveassestcsaisgedasdavntenasiaaates paaieen teas cenanioaotanbaseestedconeGethaterentanisaneaioun il 
TIN TROD UG TION sc5s2cetsstiscaaenhascensdesseansshadcxanadeucnaieiocstded eesladeomaonnision abate iaemaene 1 
BACKGROUND 2c cna eee ee 2 
A. |B) I cael 0) g epeeere enrnee ere er tert Prt ORR TERE re Seer ne rrr ore ner rnp eee re tt cen ec enr rer arr eer rent rere eat 3 
B SB Tse snsarsee sine Bacio cwenis nse cooisatirea na dastowsdanctundncusessoutseetiatemctaneuscnisiee 5 
C Ridley sO) ne 01 Ve POLICE sns'servonneuansnsacsusssncas sates tuowennesseutwnnenensedsutsabestasleeenusueesestesens 5 
D Ereb’s Intenit- Based) penis yagcccccssseviesneadsecunnacencesedeeetnuacenchreummacsebarseaveassetensacerens 8 
TEE ATG AA Dc scossaccsacciceenhaavceaveaaesen Aereanccmeieum ene asec ene oe ieee 8 
PUR GUIVIEN T  sisiicicosscennnyhsicnatanncvcseshsaevnaihenccwrpiatavaasaacveatsaadaaatsciacnaphadareastedecuaphadnanaasiaentaaneens 10 


I. LIEB IS NEITHER QUALIFIED TO OFFER OPINIONS ABOUT THE DLP 
REPORT AND CROWDSTRIKE LOG NOR ARE HIS OPINIONS BASED ON 


A RELIABLE ME THODOLOG ¥ .nccsssisccasecencisaea ites acnsterainie aera ieee saaeeionned) 10 
A. Lieb Is Not Qualified to Offer Opinions About the DLP Report and 
Cr WS thee: TIO We cx sahcctnnsdsetissauencesahcenccaagheaesoadsnaeteuneenuntaauliasaneianisaciadasetauenlanos 10 
B. Lieb’s Opinions About The DLP Report And CrowdStrike Log Are Not 
Based On o Reliable Methodology. ssiscescsssnesnsaseresnensonatstenessnasoaeaeatannaesecnteatsanrnte 14 
Il. LIEB’S ONEDRIVE DELETION OPINIONS ARE SPECULATIVE AND 
INR LIAB CE. nessosshessinssassatnseabantonsqeuncnden dscns tian ceedeutsnlenchaneneucancvandisedesedestnihadtnaweapecestecxays 15 
Il. © LIEB CANNOT OFFER OPINIONS REGARDING STATE OF MIND OR 
TISEICIETN I, ctanmnnsian ss Gasrspaneenadioasin ateaninaapateeninena ina am mace aR ane nei 12 
Iy,. LIEB CANNOT OFFER LEGAL OPINIONS visssicssasidestsoncsncsaasienvesinnanvedeansectiaeneavtednewevaas 21 
V. LIEB’S REBUTTAL OPINIONS ARE MISLEADING AND UNFAIRLY 
PREJUDICIAL, c.sicaiiimneinne ase atom aeaNihaiImina nine 22 
CON CE USIOIN :i:scistacatnnistaanaliasatonninestsilbnasnniienadniieiaikasinissonarnatiasinemiien a eaaendienenianas 24 
i 


Case 1:22-cv-00050-TRM-SKL Document 258 Filed 05/25/23 Page 2 of 30 PagelD #: 6515 


TABLE OF AUTHORITIES 


CASES 
Apple, Inc. v. Samsung Elecs. Co., Ltd., 2014 WL 794328 (N.D. Cal. Feb. 24, 2014)... 10 
Ask Chems., LP v. Comp. Packagers, Inc., 593 F. App’x 506 (6th Cir. 2014)... cece 10, 17 
Berry v. City of Deira, 25 F.3d 1342 (th Cir, 1994) ga srs ress secacacestescquteanataceceencqutsieaianeaade W212 
Biedermann Techs. GmbH & Co. KG v. K2M, Inc., 2022 WL 3337792 (E.D. Va. July 8, 

QU 22 ) wc vatvadnccaresetecaouacedeodatnsdugcsssliileys share dcanlsbue luck anlenallascaereedsablienleauvnbdiuntsctssledediulantetualtasens 23 
Brown vy. City of Shelbyville, 2020 WL 13173275 (E.D. Tenn. Sept. 17, 2020) 0... eee passim 
Caudill Seed & Warehouse Co., Inc. v. Jarrow Formulas, Inc., 2019 WL 1435934 (W.D. 

a tear c acces ccc ems nse s ea ee  nce aaa es hc ecco ec eeeepeeecceee 21 
Citizens Fin. Grp., Inc. v. Citizens Nat’l Bank of Evans City, 383 F.3d 110 (3d Cir. 2004)......... 17 
Coffey v. Dowley Mfg., Inc., 187 F. Supp. 2d 958 (M.D. Tenn. 2002)... ceeeecceesseceteceseeeeeeeenees 18 
Coffey v. Dowley Mfe., Ing, 89 F.. App x 927 (oth Cir. 2003): ci ccssshidecessiicasiaspnidasanidcnuaoniemassuces 18 
Daubert v. Merrell Dow Pharms., Inc., 509 U.S. 579 (1993) ..ccccccssssccesscecssecesseeeesseeeees 1, 10, 15, 23 
Flex Homes, Inc. v. Ritz-Craft Corp, 491 F. App’x 628 (6th Cir. 2012)... ee eeeeeceseceeeneeeneeerees 9 
General Lice, Co. WiJoimer: S22 US. TAG (L997) sass cdsevassneewadautsenienieioertardacsnantiuenvecntacwtonndovesndes 16 
Hershey v. Pacific Inv. Mgmt. Co. LLC, 697 F. Supp. 2d 945 (N.D. IIL. 2010) wo. eeeeeeeeeee 20 
Hillerich & Bradsby Co. v. Travelers Prop. Cas. Co., 2007 WL 403596 (W.D. Ky. Jan. 

NOY Tide ce tek cs clearence cepa ea bi eee ree eens ieaaciaedt Reece 10 
Jinro Am. Inc. v. Secure Investments, Inc., 266 F.3d 993 (9th Cir. 2001) .......cccccccssceesseeesseeeesees 10 
Lawrence v. Raymond Corp., 501 F. App’x 515 (6th Cir. 2012) oo... ee ccecceesceeseeceeceeeeeeeeeeeeenaeees 8 
Little v. City of Morristown, 2023 WL 2769446 (E.D. Tenn. Mar. 31, 2023) 

oes hic cnealeee vce ean saanduan eons apbiateaan lucien cbiadedaewutateabataacatcuteltcah ea eclrax uaa uiah ideas delaedacenscuucecauea: 19, 20, 21 
Madey ¥.. Maiden, 991 F.30 304 (Oil Cite 2020) csitcce sacri siesanedaucntpecgsisactuastenctessecacedsteentennzaateabudlees 10 
Malletier v. Dooney & Bourke, Inc., 525 F. Supp. 2d 558 (S.D.N.Y. 2007)......ccccceecceesseeteeeteeeees 11 
Marmo vy. Tyson Fresh Meats, Inc., 457 F.3d 748 (8th Cir. 2006) .......ccccecsseceseceeeceeseeeseeesteenteeeees 14 
Moisenko v. Volkswagenwerk Aktiengesellschaft, 198 F.3d 246 (6th Cir. 1999) oo. eeeeeeeeee 23 


il 


Case 1:22-cv-00050-TRM-SKL Document 258 Filed 05/25/23 Page 3 of30 PagelD #: 6516 


Newell Rubbermaid, Inc. v. Raymond Corp., 676 F.3d 521 (6th Cir. 2012) .....eceeeeeeeeees passim 


Okland Oil Co. v. Conoco Inc., 144 F.3d 1308 (1Oth Cir. 1998)... ccc eccsecesscccessceesssceesseeeesseees 21 
Pridev. BIC Corp, 218 F.3d 566 (6th Cit, 2000) occ2sccassccticseavcicistas sdacainsseciaisasdecandveniuselaivcaensaioens 15 
Proofpoint, Inc. v. Vade Secure, Inc., 2021 WL 2383574 (N.D. Cal. June 10, 2021)... 22 
Summerland v. Cnty. of Livingston, 240 F. App’x 70 (6th Cir. 2007).......:cccecsceesceesteceeeeeeeeeeeeees 22 
Superior Prod. P’ship v. Gordon Auto Body Parts Co., 784 F.3d 311 (6th Cir. 2015)... 20 
Synopsys, Inc. v. Risk Based Security, Inc., 2022 WL 3005990 (E.D. Va. July 28, 2022) 

asus ncdiinsb acuta dibansa a gaciiens dawaadup ecaaedd csuaies fhownnbl gheuskanaeocunsiaduanaaengocan ala bveksaeduameannatensiuahelunabeedeants 16, 17 
Tamraz v. Lincoln Elec. Co., 620 F.3d 665 (6th Cir. 2010) oo... ccccecessceceseecsseeessseeeees 9, 12, 14, 15 
Thomas v. Novartis Pharma. Corp., 443 F. App’x 58 (6th Cir. 2011) .......ceeeecccescecsteceseeeeeeeenees 15 
United States v. LeBlanc, 45 F. App’ x 393 (6th Cir, 2002 )sessscsssssesssascusinvsdausssssndsadennsatoarsnsdiasvstinss 9 
United States v.. Semrau, 693 F.3d 510 (6th Cit, 2012) ss ssvesannsasnesinbartseevewausetensesaaveavedavetenteotesutees 9 
Vanderpool v. Edmonson, 2005 WL 5164857 (E.D. Tenn. Mar. 23, 2005)... ce ceceereereees 13, 15 
Williams v. Syphan, 2023 WL 1305084 (6th Cir. Jan. 31, 2023) oes eeeseseeecreeseeeeeeseeeees 12, 14 
Yancey v. Carson, 2007 WL 3088232 (E.D. Tenn. Oct. 19, 2007)... eee eeeceeceeteeeeeeeeeeteeeees 19, 20 

STATUTES AND RULES 
Defend Trade Secrets Act (“DTSA”™), 18 U.S.C. § 1839 wiiscssssnccesssniiasasasncceasteniasssealessssigorsovainne ee | 
Tennessee Uniform Trade Secret Act (““TUTSA”), Tenn. Code Ann. 

B25 TOL 2) acaties ca detsicerucasoca td iratutcinn taeda eeceialxaesdnslaauls sa ictal sSeuaretenn ta etulentdlawitalarbarustealee 2,21 
Federal Rule os Civil Procedare 2G) D \iccsssacerisssivcaansdinnnsdizdeccunke diccoladdeaadecatiaiasiie addled lato 23 
Federal Rule of Evidence 403 .........ccciccccccsccccccessesssssssccscevcesessssssssscescesessessssssssceveessessssseseesees 2, 9, 23 
Federal Rule of Evidence 702.........cceccccccccccccessssssssssscsccssesssssessssccseessesssssssesccuseesssssassesecs 1, 8,9, 21 


ili 


Case 1:22-cv-00050-TRM-SKL Document 258 Filed 05/25/23 Page 4 of30 PagelD #: 6517 


INTRODUCTION 

The opinion testimony of Laurence D. Lieb, Plaintiffs’ designated expert witness on 
forensic issues, falls well short of the standards for admissibility set forth in Federal Rule of 
Evidence 702 and Daubert v. Merrell Dow Pharms., Inc., 509 U.S. 579 (1993). 

Lieb rests his opinions, all of which relate to Ridley’s alleged misappropriation and misuse 
of Plaintiffs’ purported trade secrets, principally on two pieces of evidence—Plaintiffs’ data loss 
prevention report (“DLP Report”) and ChemTreat’s CrowdStrike log, both of which reflect user 
activity on electronic devices. But Lieb has no training, experience, or expertise with respect to 
that software or these reports, and is thus unqualified to render his opinions, which suffer from 
crippling methodological defects as well. Lieb in addition relies heavily on a particular OneDrive 
subfolder to show that “Ridley exfiltrated thousands of Ecolab files and then deleted those same 
files” from his Ecolab OneDrive folder. The problem: The folder Lieb has reviewed was not copied 
from Ridley’s cloud-based OneDrive folder or even Ridley’s laptop; rather, it was copied from the 
laptop of an Ecolab paralegal months after Ridley left. Lieb cannot reliably say with any degree of 
confidence, and certainly not with the degree of confidence that Rule 702 requires, that he in fact 
is reviewing and opining on Ridley’s OneDrive folder at all. 

Lieb elsewhere offers patently inadmissible opinions. He opines repeatedly regarding 
Ridley’s state of mind. Lieb testified, for example, that he “use[s] the word ‘intent’ . . . and that 
[it] is . . . [his] opinion as to why [Ridley] stole those files.” Ex. 1 at 243:1-7. His report is replete 
with similar references. Lieb likewise reaches legal conclusions, opining, for example, that Ridley 
“misappropriated” Ecolab’s files. Misappropriation is a legal term under the DTSA and TUTSA, 
and an issue for the jury, not an expert. Finally, in his rebuttal report, Lieb asserts there are sources 
of information that he believes are “conspicuously absent” from the report of ChemTreat’s own 


forensic expert. Those sources were not produced in discovery and are not part of the factual 
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record. Federal Rule of Evidence 403 precludes Lieb from speculating as to what other evidence 
might exist or the contents of any such “missing” evidence. 
BACKGROUND 

Ridley worked for Nalco and Ecolab (together “Ecolab”) in various positions from 
November 1, 1999, until July 1, 2021. He joined ChemTreat as a Field Sales Representative on 
July 2, 2021. Plaintiffs bring claims against Ridley for breach of his employment agreement, and 
against ChemTreat for tortiously interfering with that agreement. Doc. 229 at 43-56, 59-63. 
Plaintiffs also bring claims under the Defend Trade Secrets Act (““DTSA”), 18 U.S.C. § 1839(5), 
and the Tennessee Uniform Trade Secret Act (“TUTSA”), Tenn. Code Ann. § 47-25-1702(2). Id. 
at 47-53. 

Plaintiffs proffer the forensic opinion testimony of Laurence D. Lieb regarding Ridley’s 
alleged misappropriation and use of what Plaintiffs contend is their trade secret information. Ex. 
2. In forming his opinions, Lieb considered four sources of information: (1) Plaintiffs’ DLP Report 
and the website of Digital Guardian, the company whose software generated the report, id. 47; Ex. 
1 at 55:9-15; (2) ChemTreat’s CrowdStrike log and a brief conversation with unidentified 
CrowdStrike employees, Ex. 2 9] 7, 58; (3) a forensic image of a folder collected from an Ecolab 
paralegal’s hard drive in January 2022, Ex. 1 at 117:7-13; and (4) forensic images of three USB 
drives, Ex. 2 § 32. Lieb did not consider any additional evidence in the record, such as deposition 
testimony or produced documents (including Plaintiffs’ 0365 Log which, like the DLP Report, 
reflects Ridley’s digital activity prior to his resignation). Jd. 7; Ex. 1 at 123:23-124:8. 

Lieb offers three opinions relevant to this motion. First, Lieb opines that Ridley 
“exfiltrated” and “misappropriated thousands of Ecolab’s files” before deleting files from his 
Ecolab OneDrive folder. Ex. 2 9] 12, 14, 41, 43, 50. (Lieb testified that “exfiltration” and 


“misappropriation” mean “theft.” Ex. 1 at 203:15-16, 204:20-23.) Second, Lieb also opines that 
2 
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Ridley downloaded Ecolab files with the intent to use them at ChemTreat, and later deleted files 
to hide this alleged conduct. Ex. 2 §{] 24, 35. Third, Lieb opines that ChemTreat’s forensic expert, 
Jim Vaughn, failed to search every possible repository of electronic documents before forming his 
own opinions. Ex. 3 Jf 31, 34, 35, 40, 54. 

A. DLP Report 

Plaintiffs generated a DLP Report on July 23, 2021. Ex. 4 at 136:11-18; Ex. 5 at 23. ADLP 
Report is a large Excel file, with cells indicating different electronic devices and files a user 
interacted with while logged into Ecolab’s computer system, as well as the manner in which the 
user interacted with them. Ex. 2 § 12; Ex. 4 at 177:5-187:20. Plaintiffs have a standard procedure 
for running DLP Reports, which includes prompting the software to identify whether a user deleted 
files. Ex. 6 at 2; Ex. 4 at 99-102, 208-209. The DLP Report that Plaintiffs produced regarding 
Ridley’s activity covers 62 days and reflects no deletion activity. Ex. 7; Ex. 1 at 264:1-8; Ex. 8 at 
37:8-38:9. Plaintiffs also produced a copy of an “Office 365 Audit Log” (“O365 Log’’) that “logs 
and journals employee activity” within OneDrive. Ex. | at 42:9-12. That log captured Ridley’s 
activity between June 4, 2021 and July 1, 2021. Ex. 9. The 0365 Log is designed to capture 
deletion activity, amongst other actions. Ex. 8 at 46:15-47:12; Ex. 9 at Column T. The 0365 Log 
for Ridley did not show deletion of any relevant files. Ex. 10 at 20-21. 

Lieb has no prior experience with Digital Guardian software or DLP Reports: 


Q: .... [W]hat is your personal experience with Digital Guardian? 


A: My personal experience with Digital Guardian actually began with the Ridley 
matter. 


Q:...[S]o you had not used Digital Guardian before you were retained for this 
litigation? 


A: Correct. 
Q: Did you receive training on Digital Guardian? 
A: I did not. 
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Q: Have you ever personally run a Digital Guardian report? 
A: [have not.... 
Q: ... [H]ow many Digital Guardian reports have you examined? 


A: To date, I believe three, one in each of the cases [Ecolab has subsequently 
brought against ChemTreat and/or its employees]. 


Ex. | at 45:8-46:23. Before this case, Lieb was not aware that Digital Guardian was a data loss 
prevention software application. Jd. at 50:15-23. 

Lieb’s “forensic analysis” of the DLP Report, in his words, consisted of “just reading” the 
Excel file, as any layperson could do. /d. at 181:8-10. When tasked with analyzing the DLP Report, 
Lieb did not ask anyone at Ecolab or Digital Guardian to explain the terms used in the DLP Report, 
and was not sure what certain terms meant, such as “Alert Was Blocked.” Jd. at 181:25-182:13, 
183:5-15. He explained that: 

[I]t would be asking me to speculate what alert was blocked... what that 

means... . I don’t know if that means that the action was blocked or that the alert 


was blocked.... I didn’t ask anyone to expand on what that particular column 
means. 


Id. at 183:6-11. Nonetheless, Lieb “interpret[ed]” the DLP Report using five steps: (1) he “opened 
it up in Microsoft Excel,” id. at 162:18-163:4; (2) he froze the first row and column, id.; (3) he 
used the “filter” function—which he described as “little drop-down arrows”—to see what 
categories of information were included in the DLP Report, id.; (4) he focused on the “rule 
violation” column because he believed, without explanation, that the other columns “were not 
relevant to this dispute,” id. at 163:5-16, and only rule violations “show any evidence... of 
exfiltration,” id. at 185:21-186:3; and (5) he filtered by date of activity to reach his final 
conclusions about “which files were exfiltrated ... on a specific day,” id. at 163:17-24; see also 
id. at 171:19-177:15. When he recreated this methodology during his deposition, he was left with 


a list of 576 rule violations, id. at 185:21-186:11, which contradicted the conclusion in his report 
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that the DLP Report showed Ridley’s exfiltration of “thousands” of files, Ex. 2 J 14. 

B. CrowdStrike Log 

ChemTreat produced a report regarding Ridley’s activity as a ChemTreat employee using 
a software application designed to monitor external file access and USB activity. Ex. 11; Ex. 12 
at 11. Upon realizing that the first laptop ChemTreat had issued to Ridley had been mistakenly 
reformatted and issued to a new user (resulting in the loss of data relating to Ridley’s use of the 
laptop), ChemTreat used a data protection program called CrowdStrike to generate a log reflecting 
external USB activity on that laptop. Ex. 12 at 11, 35. The CrowdStrike log identifies all external 
USB devices accessed (identified by serial number), any files accessed from such devices, and the 
date and time of access. Jd. at 35, 37-38. Thus, although the data on the first laptop was lost, 
ChemTreat was able to determine what, if anything, had been accessed on that laptop, and when. 

Lieb’s claimed “forensic analysis” of the CrowdStrike log, Ex. 2 § 51, was much the same 
as his analysis of the DLP Report: “first attempting to open the actual file itself’ and then running 
generic term searches for “Nalco, Ecolab, USB, USB drive, hotmail, Google, Gmail, Yahoo and 
serial numbers.” Ex. | at 287:22-23, 288:7-14. Despite his lack of experience with either software, 
Lieb opines that Plaintiffs’ DLP Report is a reliable method of analyzing a user’s actions on a 
device that is no longer available, whereas ChemTreat’s CrowdStrike log is not. Ex. 2 ff 12, 58- 
3: 

C. Ridley’s OneDrive Folder 

Both Ecolab and ChemTreat use Microsoft software applications, including a cloud-based 
electronic document storage platform called OneDrive. Ex. 1 at 40:6, Ex. 12 at 10. OneDrive can 
be configured so that a single user has access to an electronic folder, but it also has file-sharing 
capabilities, allowing multiple people to access and edit documents in a shared folder. Ex. 8 at 


26:23-28:13. For example, Ecolab assigned a particular OneDrive folder to Ridley for his use, and 
° 
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he shared access to it with at least three other Ecolab employees. Ex. 13 at 148:13-149:9; Ex. 14 
at 222:17-24. 

Ridley resigned his Ecolab employment on July 1, 2021, Ex. 15, and Ecolab began 
considering possible legal action that same day, Ex. 16. Plaintiffs nonetheless waited nearly seven 
months, until January 25, 2022, before asking Lieb to create a forensic image—an exact electronic 
copy—of a folder that was, allegedly, a copy of Ridley’s OneDrive folder. Ex. 1 at 21:8-24, 117:7- 
13. The folder that Lieb imaged was not a cloud-based OneDrive folder like the one Ridley had 
used while employed by Ecolab. The folder Lieb imaged was located on the hard drive of the 
computer assigned to an Ecolab paralegal. /d. at 117:7-13. Lieb remotely accessed the paralegal’s 
computer to create the forensic image. /d. at 87:14-23. He testified about his involvement in this 
belated preservation attempt: 

Q: You collected this folder, which has a completely different name [than the file 

path reflected on the DLP Report], seven months later, from the hard drive of a 


paralegal at Ecolab based on representations to you that it was the only information 
they had for you; correct? 


A: That is correct.! 


Id. at 117:7-13. Lieb testified that he had no information about the chain of custody for the folder 
he collected from the paralegal’s computer in January 2022: 
Q: So when was the folder that you forensically collected placed on [the 
paralegal’s] hard drive? 
A: I don’t know. 
Q: Where did that folder come from? 
A: I don’t know. 


Q: Do you know whether Mr. Ridley’s OneDrive had remained in active use by 
other employees in the intervening months? 


A: I don’t. 


Q: Do you know whether it had to be restored in whole or in part? 


' Unless noted, all emphasis is added and quotations are cleaned up with internal citations omitted. 
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A: I do not. 

Q: Do you know whether it had to be reconstituted in whole or in part? 

A: I do not. 

Q: Do you know whether it had to be recovered in whole or in part? 

A: I do not. 

Q: Do you know how it came to be located on the hard drive of [the paralegal]? 
A: I do not. 


Id. at 97:2-23. Lieb did not obtain, create, or maintain a chain of custody record of any of this vital 
information, id. at 18:16-24, 21:13-16, 157:14-18, despite his belief that “‘[i]t is critical to use... 
industry-standard chain of custody forensic software that will preserve and maintain which specific 
person has sole control over a specific single source of electronic evidence up to a time and date 
certain.” Ex. 2 4 11. 

Lieb concludes that files missing from the image he collected of this folder from a 
paralegal’s hard drive in January 2022 support his conclusion that Ridley deleted files from his 
OneDrive before leaving Ecolab on July 1, 2021. Id. 9] 41, 43, 50. Lieb testified that: “[He] 
analyzed the contents of the forensic image of Anthony Ridley’s OneDrive account data and 
compared it to the files described as having existed or existing in Anthony Ridley’s OneDrive 
account in the Digital Guardian report.” Ex. | at 96:8-11. Lieb assumed, based on representations 
from counsel, that the folder he imaged in January 2022 was a complete copy of Ridley’s OneDrive 
as it existed on July 1, 2021. Jd. at 93:23-94:2, 95:24-96:11. Based on this assumption for which 
there is no evidentiary support, Lieb concluded that a “now deleted ‘ridley’s nalco folder’ folder 
would have existed” at the time Lieb forensically imaged Ridley’s alleged OneDrive folder on 
January 25, 2022, “but for the fact that Ridley deleted [that] folder from his Ecolab OneDrive after 
downloading [that] folder and [its] contents to the LaCie drive” between May 22 and July 1, 2021. 


Ex. 2 99 13, 45. 
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D. Lieb’s Intent-Based Opinions 

Lieb purports to offer expert opinion testimony that Ridley downloaded Ecolab files with 
the intent to use them at ChemTreat, and Ridley later deleted files to hide this alleged conduct. Id. 
{4 24, 35. Lieb testified: 


Q: ...[Y]ou are offering an opinion about Mr. Ridley’s intent with regard to actions 
you say he took, correct? 


A: Yes. That I use the word “intent” there and that is... my opinion as to why he 
stole those files. 


Ex. | at 243:1-7 (referencing Ex. 2 § 24). Examples of Lieb’s “intent” opinions include: 


e “Tt is my opinion that Ridley exfiltrated the many Ecolab files documented in 
this report specifically to utilize them while employed at ChemTreat.” Ex. 2 4 
24; Ex. 1 at 241:21-25. 


e “Mr. Ridley deleted the files listed below in Table 2 in a failed attempt to hide 
the fact that the drive contained Ecolab files.” Ex. 2 § 35. 


e “Ridley attempted, but failed to hide the fact that he was in possession of the 
abovementioned Ecolab files.” Jd. { 40. 


e “Ridley exfiltrated and then destroyed a significant number of Ecolab files in 
an attempt to deprive his former employer access to these same files.” Id. § 41. 


e “Tt is my opinion that there was absolutely no need to ‘declutter’ his OneDrive 
account, but in fact this act of deletion was designed to deprive Ecolab access 
to these same files.” Id. § 48. 


e “[A]ll evidence is consistent with the fact that Ridley exfiltrated thousands of 
Ecolab files and then deleted those same files to deprive Ecolab access to 
them.” Id. ¥ 50. 


e “It’s my opinion that [Ridley] took those files to use them to compete against 
his former employer.” Ex. | at 204:1-5. 


e “{Ridley] took [the files] to use while working at ChemTreat.” Id. at 207:11- 
16. 


LEGAL STANDARD 
“The admissibility of expert witness testimony is governed by Rule 702 of the Federal 
Rules of Evidence.” Lawrence v. Raymond Corp., 501 F. App’x 515, 517 (6th Cir. 2012). Expert 
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testimony should be excluded unless “the witness is sufficiently qualified, the testimony is 
relevant, and the testimony is reliable.” Flex Homes, Inc. v. Ritz-Craft Corp, 491 F. App’x 628, 
638 (6th Cir. 2012). “The proponent of expert testimony must establish its admissibility by a 
preponderance of proof.” United States v. LeBlanc, 45 F. App’x 393, 400 (6th Cir. 2002). The 
proponent must do so by demonstrating that the expert: (1) used “technical[] or other specialized 
knowledge [that] will help the trier of fact to understand the evidence”; (2) formed opinions “based 
on sufficient facts or data”; (3) formed opinions that are “the product of reliable principles and 
methods”; and (4) “reliably applied the principles and methods to the facts of the case.” Fed. R. 
Evid. 702. 

When assessing methodology, courts consider whether the methods have been or can be 
tested, have been subject to peer review, have any known error rates, and have been generally 
accepted in the field. Newell Rubbermaid, Inc. v. Raymond Corp., 676 F.3d 521, 527 (6th Cir. 
2012). “Red flags that caution against certifying an expert include reliance on anecdotal evidence, 
improper extrapolation, failure to consider other possible causes, lack of testing, and subjectivity.” 
Id. “[T]he ‘ipse dixit of the expert’ is alone not sufficient to permit the admission of an opinion.” 
Tamraz v. Lincoln Elec. Co., 620 F.3d 665, 671 (6th Cir. 2010). 

“TA] judge assessing a proffer of expert... testimony under Rule 702 should also be 
mindful of other applicable rules” including Rule 403. Brown v. City of Shelbyville, 2020 WL 
13173275, at *6 (E.D. Tenn. Sept. 17, 2020). “[A] court [can] exclude relevant evidence if its 
probative value is substantially outweighed by a danger of confusing the issues or misleading the 


jury, among other things.” United States v. Semrau, 693 F.3d 510, 523 (6th Cir. 2012). 
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ARGUMENT 
I. LIEB IS NEITHER QUALIFIED TO OFFER OPINIONS ABOUT THE DLP 


REPORT AND CROWDSTRIKE LOG NOR ARE HIS OPINIONS BASED ON A 
RELIABLE METHODOLOGY. 


A. Lieb Is Not Qualified to Offer Opinions About the DLP Report and 
CrowdStrike Log. 


“[C]are must be taken to assure that a proffered witness truly qualifies as an expert” on the 
topics on which they opine. Jinro Am. Inc. v. Secure Investments, Inc., 266 F.3d 993, 1004 (9th 
Cir. 2001); accord Ask Chems., LP v. Comp. Packagers, Inc., 593 F. App’x 506, 510 (6th Cir. 
2014) (An unqualified expert opinion “cloaks unexamined assumptions in the authority of expert 
analysis.”). This is because a witness who “c[omes] before the jury cloaked with the mantle of an 
expert” provides “statements [that are] likely to carry special weight with the jury.” Jinro Am. Inc., 
266 F.3d at 1004; see also Apple, Inc. v. Samsung Elecs. Co., Ltd., 2014 WL 794328, at *9 (N.D. 
Cal. Feb. 24, 2014) (“Juries are likelier to credit experts, who are perceived to possess special 
relevant knowledge”); Hillerich & Bradsby Co. v. Travelers Prop. Cas. Co., 2007 WL 403596, at 
*1 (W.D. Ky. Jan. 31, 2007) (expert’s opinion carries with it “respectability” and “credibility”’); 

In short, expert testimony “can be both powerful and quite misleading.” Daubert, 509 U.S. 
at 595. To alleviate these risks, courts exercise their gatekeeping function to ensure experts do “not 
broadly testify about an area in which they possess[] no specialized knowledge.” Brown, 2020 WL 
13173275, at *7. In doing so, “courts consider whether the qualifications ‘provide a foundation for 
a witness to answer a specific question,’ as opposed to considering his or her qualifications in the 
abstract.” Id. at *5; see also Madej v. Maiden, 951 F.3d 364, 370 (6th Cir. 2020) (“When a[n] 
[expert’s] opinion ‘strays from’ [his] ‘professional experience,’ the opinion is ‘less reliable.’”’). 

Lieb is not qualified to render opinions regarding the DLP Report, including its meaning 


and significance. His “credentials as set forth in the record do not qualify him to know any more 
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about” that report than a layperson, Berry v. City of Detroit, 25 F.3d 1342, 1352 (6th Cir. 1994) 
(emphasis in original), and his forensic experience or expertise, whatever it may be, does not 
extend to expert review and interpretation of any and all electronically stored data. Jd. (“A divorce 
lawyer is no more qualified to opine on patent law questions than anyone else, and it is a mistake 
for a trial judge to declare anyone to be generically an expert.”). Lieb’s testimony confirms that he 
lacks the experience or expertise (neither of which he sought to obtain in connection with his work 
here) that would qualify him to draw reliable conclusions from the DLP Report. Malletier v. 
Dooney & Bourke, Inc., 525 F. Supp. 2d 558, 616 (S.D.N.Y. 2007) (“thin qualifications” are 
“relevant to the reliability inquiry”). 

Lieb’s firm, Tyger Forensics, specializes in “forensic preservation and collection of 
electronic evidence, generation of forensic databases ... , [and] forensic analysis of evidence.” 
Ex. | at 16:20-17:2. Lieb explained that his “forensic review of electronic evidence” generally 
entails generating a timeline of events, generating a searchable database, developing and executing 
keyword searches, and tagging documents of interest. Jd. at 27:15-28:14. Lieb had no personal 
experience with Digital Guardian before this case. He has never received training regarding Digital 
Guardian, and he has never run a Digital Guardian report. /d. at 45:8-46:23. His “understanding of 
the Digital Guardian data loss prevention tool is related to [his] research performed reading 


[Digital Guardian’s] website and analyzing the report, itself.”? Jd. at 55:9-15. In fact, he first 


? In early 2022, Lieb spoke with Jennifer Semmler, the Ecolab employee who generated the DLP 
Report in this case. Ex. 1 at 69:7-14. Lieb did not cite, or mention in his report, his conversation 
with Semmler as a fact he considered when forming his opinions. Nor did Lieb recall much about 
the discussion at deposition. He vaguely recalled that Semmler confirmed the accuracy of 
“whatever the time period . . . we see” in the DLP Report, id. at 70:5-9, and told him Ecolab’s DLP 
Reports cover 60 days of activity, id. at 70:5-9, 70:17-20. However, Semmler—the person who 
actually generated the DLP Report in this case—testified that she always generates them for 90 
days (the maximum period) as a default, Ex. 4 at 41:8-24, 144:14-22, 173:25-175:4, and the DLP 
Report produced here covers 62 days, Ex. 8 at 37:8-38:9. Lieb did not investigate these 
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learned that Digital Guardian is a “data loss prevention tool” when he went to Digital Guardian’s 
website in connection with this assignment. /d. at 50:15-23 (noting that this information was “right 
on the front page of their website”). 

Nor did Lieb’s alleged forensic analysis of the DLP Report require any specialized skill or 
training. Although Lieb’s forensic analysis was limited to sorting and filtering an Excel 
spreadsheet (see Ex. 1 at 162:18-163:4, 163:17-24, 171:19-177:15, 185:21-186:3), counsel 
nonetheless had to assist him in performing those same functions during the deposition. /d. at 
270:24-271:17. Nothing about Lieb’s methodology requires, or relies upon, specialized knowledge 
or training; as he admitted, his opinions were a matter of “just reading ... what they’re saying” 
(meaning the cells in the DLP Report spreadsheet). Jd. at 181:8-10. Indeed, Lieb disavowed any 
knowledge about what the various cells in the DLP report meant. See, e.g., Ex. 1 at 183:5-11 (“I 
don’t know if that means that the action was blocked or that the alert was blocked . . . . I didn’t ask 
anyone to expand on what that particular column means.”). In fact, Lieb did not ask anyone to 
expand on what any of the terms in the DLP Report meant. /d. at 181:25-182:13. Rather, Lieb 
speculated about their meaning. But “the courtroom is not the place for scientific guesswork, even 
of the inspired sort.” Tamraz, 620 F.3d at 671. The Court should therefore exclude Lieb’s opinions 
related to, or derived from, the DLP Report. Lieb lacks any specialized knowledge or expertise to 
offer opinions about or interpret this document, such that his “forensic analysis” is of “equal parts 
extrapolation and speculation” and is therefore unreliable. Williams v. Syphan, 2023 WL 1305084, 
at *3 (6th Cir. Jan. 31, 2023). 


Lieb similarly is not qualified to offer opinions regarding the CrowdStrike log. His 


discrepancies, but reached his conclusions “[w]ithout questioning or verifying the data and without 
conducting any tests of his own.” Newell Rubbermaid, 676 F.3d at 528. 
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opinions about the software, as he admitted, rested principally on a call with unnamed CrowdStrike 
employees and (unspecified) commentary on CrowdStrike’s website. Ex. 1 at 346:15-348:5; see 
also id. 300:9-24. Consistent with his (at best) limited knowledge, several of Lieb’s conclusions 
displayed his unfamiliarity with CrowdStrike logs. For example, Lieb testified that ChemTreat’s 
“CrowdStrike report lists a Volume 5 and Volume 6 and it doesn’t list the make, model and serial 
numbers of those external USB devices.” /d. at 209:9-12, 301:16-302:5; see also Ex. 3 § 43 (“Also 
omitted from Vaughn report [sic] is the makes, models and serial numbers of these two USB drives 
because the CrowdStrike omits this critical information!”). Lieb was apparently unaware (although 
it is easily ascertainable) that the CrowdStrike log does, in fact, list the make, model, and serial 
numbers of the USB devices, as an exhibit prepared by Plaintiffs’ counsel themselves 
demonstrates, Ex. 17. This error underscores the unreliability of his opinions related to the 
CrowdStrike log. See Vanderpool v. Edmonson, 2005 WL 5164857, at *3, *5 (E.D. Tenn. Mar. 
23, 2005) (excluding expert opinion as unreliable when “predicated on... incorrect and false 
premise[s]”). Likewise, Lieb erroneously states that the CrowdStrike log did not “record[] or 
capture[]” Ridley’s interaction with a document he emailed from his personal email account to his 
ChemTreat email account. Ex. 3 § 19. Either Lieb did not know that a simple search for that file 
name in the CrowdStrike log confirms that the log did record and capture that activity (which 
would underscore his lack of expertise) or he did not bother to perform that search (which would 
underscore his failure to apply any recognized methodology). Ex. 11. Either way, Lieb is not 
qualified to render opinion testimony regarding the CrowdStrike software in general or 


ChemTreat’s CrowdStrike log in particular. Any such opinions that he offers are, therefore, 
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unreliable.? Marmo v. Tyson Fresh Meats, Inc., 457 F.3d 748, 757 (8th Cir. 2006) (“Expert 
testimony is inadmissible if it is speculative, unsupported by sufficient facts, or contrary to the 
facts of the case.”). 


B. Lieb’s Opinions About The DLP Report And CrowdStrike Log Are Not 
Based On a Reliable Methodology. 


Experts must “explain why or how [they] could reach the conclusion[s]” they reached. 
Williams, 2023 WL 1305084, at *2. “The ‘ipse dixit of the expert’ alone is not sufficient to permit 
the admission of an opinion.” Tamraz, 620 F.3d at 671. 

Although Lieb provided a step-by-step summary of his analysis, as described above, his 
methods fall apart when subject to even the slightest scrutiny. At deposition, Lieb was unable to 
replicate his analysis. Lieb testified, without explanation, that he filtered the DLP Report based on 
Column ET, “Rule Violations,” so that the DLP Report showed “just rule violations because in 
[his] opinion. .. that’s all that’s really relevant.” Ex. 1 at 185:21-186:3. He further testified that 
the “rule violation” column is the only one that “show[s] any evidence ... of exfiltration.” Jd. 
When he filtered the DLP Report to show only those entries reflecting “rule violations,” however, 
the list shrank from the 94,489 entries he had asserted in his report to only 576 entries (some of 
which were duplicate file names). /d. at 186:4-11. Lieb agreed that this number accurately reflected 
every “rule violation” listed in the DLP Report. /d. Given that this number starkly contradicted the 
statement in his report that “Ridley exfiltrated thousands of Ecolab files,” Ex. 2 § 50, Lieb resorted 
to speculation. He suggested that other possible filters and columns could or might show 
exfiltration, but in doing so put himself entirely at odds with his own, steadfast opinion that only 


“rule violations” were relevant. Ex. 1 at 185:21-187:18. 


> Lieb also opines on the reliability of the CrowdStrike log in his rebuttal report. Ex. 3 §§ 12, 14- 
17. For the same reasons discussed herein, the Court should preclude Lieb from offering any 
opinions that rely on his analysis of, or draw any conclusions about, the CrowdStrike log. 
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[A] key question to be answered in determining whether a theory or technique is scientific 
knowledge that will assist the trier of fact [is] whether it can be (and has been) tested.” Daubert, 
509 U.S. at 593. If Lieb cannot replicate his own analysis, there is no means for him (or anyone 
else) to test or validate it. Pride v. BIC Corp., 218 F.3d 566, 578 (6th Cir. 2000) (upholding 
exclusion of expert who “failed timely to conduct replicable laboratory experiments” to justify or 
explain conclusions). If Lieb himself cannot explain or recreate his analysis of the DLP Report, it 
cannot withstand—or even undergo—review and potential replication by ChemTreat’s expert or 
by anyone else. See Newell Rubbermaid, 676 F.3d at 527. 

Lieb’s opinions related to the CrowdStrike log fare no better. His forensic analysis of that 
document consisted of “first attempting to open the actual file itself’ before running generic term 
searches for “Nalco, Ecolab, USB, USB drive, hotmail, Google, Gmail, Yahoo and serial 
numbers.” Ex. 1 at 287:22-23, 288:10-14. But he cannot have applied his methodology reliably, 
because it led him to conclude—contrary to the undisputed content of the CrowdStrike log—that 
it “doesn’t list the make, model and serial numbers of those external USB drives.” /d. at 209:9-12; 
Ex. 11; see also Vanderpool, 2005 WL 5164857, at *3 (excluding expert opinion as unreliable 
when “predicated on . . . incorrect and false premise[s]’’). 


I. LIEB’S ONEDRIVE DELETION OPINIONS ARE SPECULATIVE AND 
UNRELIABLE. 


“The task for the district court in deciding whether an expert’s opinion is reliable is not to 
determine whether it is correct, but rather to determine whether it rests upon a reliable foundation, 
as opposed to, say, unsupported speculation.” Thomas v. Novartis Pharma. Corp., 443 F. App’x 
58, 61 (6th Cir. 2011). Even a well-credentialed expert is “not permitted to speculate.” Tamraz, 
620 F.3d at 671. Proffered opinions “must set forth facts and, in doing so, outline a line of 


reasoning arising from a logical foundation.” Brown, 2020 WL 13173275, at *10. Courts should 
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not allow the jury to hear expert testimony that “relifes] on anecdotal evidence [or] improper 
extrapolation” or that “‘fail[s] to consider other possible causes.” Newell Rubbermaid, 676 F.3d at 
527. Thus, while “trained experts commonly extrapolate from existing data,” their opinions cannot 
be “connected to existing data only by the ipse dixit of the expert.” General Elec. Co. v. Joiner, 
522 U.S. 136, 146 (1997). Courts should heed “[r]ed flags” such as “anecdotal evidence, improper 
extrapolation, failure to consider other possible causes, lack of testing, and subjectivity.” Newell 
Rubbermaid, 676 F.3d at 527.4 Lieb’s OneDrive opinion—that “Ridley exfiltrated thousands of 
Ecolab files and then deleted those same files” from his Ecolab OneDrive folder—is full of such 
“Trjed flags.” Ex. 2 950; see also id. J 41, 43, 45. 

First, Lieb’s assertion that he collected a “complete forensic image of Mr. Ridley’s 
OneDrive account” on January 25, 2022, is anecdotal and speculative. Ex. 1 at 113:24-114:1. Lieb 
did not attempt to create a forensic image from within OneDrive, where Ridley’s electronic folder 
originally resided. He instead collected an image from the hard drive of a paralegal in Ecolab’s in- 
house counsel’s office. /d. at 21:17-18, 117:7-13. Lieb did not ask how the data came to reside on 
an Ecolab paralegal’s hard drive seven months after Ridley resigned. /d. at 96:3-11, 115:10-16, 
117:7-13. And Lieb admittedly did not know where the data came from, whether the data had to 
be restored, or whether others had access to the data before he retrieved it. Jd. at 97:2-23, 102:15- 
105:9. 

Courts routinely exclude opinions premised on similarly unsupported, and unsupportable, 


assumptions. Synopsys, Inc. v. Risk Based Security, Inc., 2022 WL 3005990, at *7 (E.D. Va. July 


* Instead of fulfilling his duty as an independent and impartial examiner, Lieb appears to have 
developed a personal interest in proving up Plaintiffs’ unsupported and speculative theories under 
an aura of expert credibility, even seeking—in his own words—“vindicat[ion]” for his opinions. 
Ex. | at 207:6. 
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28, 2022). In Synopsys, the court excluded a plaintiffs trade secret expert who “was provided no 
other context, but assumed” that a spreadsheet belonged to the defendant because the defendant 
produced it. /d. The expert’s assumptions rendered his opinion “laden with speculation and lacking 
explanation of a reliable methodology.” Jd. Lieb’s opinions are just as flawed. Lieb relied on 
counsel’s non-evidentiary representations that the data he collected was, in fact, a copy of Ridley’s 
OneDrive folder—he did not take any steps, or seek any documentation, to independently verify 
this assumption. Ex. 1 at 93:23-94:2, 115:14-16. “When an expert’s proffered opinion merely 
parrots information provided to him by a party, that opinion is generally excluded.” Ask Chems., 
593 F. App’x at 511. Indeed, courts must exclude an expert’s testimony that “willingly draws... 
conclusions despite admitting that he lacks information about the material he purports to evaluate.” 
Synopsys, 2022 WL 3005990, at *6. There is no foundation for Lieb’s threshold assertion (which 
is indispensable to his ultimate opinion) that he imaged a complete and accurate copy of Ridley’s 
OneDrive as it existed on July 1, 2021. Lieb accordingly is unable to offer an opinion based on “a 
line of reasoning arising from a logical foundation,” as required for his opinion to be admissible. 
Brown, 2020 WL 13173275, at *10; Citizens Fin. Grp., Inc. v. Citizens Nat’l Bank of Evans City, 
383 F.3d 110, 120 (3d Cir. 2004) (When an expert’s conclusions are based on unreliable evidence, 
“the universe is skewed,” and “the conclusion will similarly be skewed,” and the “jury is likely to 
give special weight to the skewed conclusion.”). 

Nor does Lieb’s underlying assumption itself rest on a sound forensic methodology. The 
forensic experts in this case agree that “best practices” require forensic examiners to utilize “chain 
of custody forensic software that will preserve and maintain which specific person has sole control 
over a specific single source of electronic evidence up to” the time and date of forensic collection. 


Ex. 2 9 11; Ex. 10 at 18. Only with this information in hand can a forensic examiner reliably 
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conduct a forensic analysis of the collected data. Yet Lieb did not use such software when he 
collected the folder he claims is a copy of Ridley’s Ecolab OneDrive. Ex. | at 157:14-18. Lieb 
also testified that his standard practice is “to generate a paper chain of custody document” when 
creating a forensic image. Jd. at 18:20-24. Again, Lieb did not adhere to this standard practice 
when forensically imaging a folder stored on an Ecolab paralegal’s hard drive. Jd. at 21:13-16. His 
conclusion that he collected “a copy of Mr. Ridley’s complete OneDrive account,” id. at 96:3-5, 
is not supported by any record evidence (in fact is contradicted by record evidence) nor is it the 
product of what Lieb himself has characterized as forensic best practices. Coffey v. Dowley Mfg., 
Inc., 187 F. Supp. 2d 958, 978 (M.D. Tenn. 2002) (“An expert must not compromise his or her 
own professional standards when acting as an ‘expert’ in a court of law.”); see also Coffey v. 
Dowley Mfg., Inc., 89 F. App’x 927, 932 (6th Cir. 2003) (upholding exclusion expert because 
opinions “were based on data which may not reflect conditions in the real world”). 

Second, Lieb’s deletion opinion relies on improper extrapolation. He concludes that “[t]his 
now deleted ‘ridley’s nalco folder’ folder would have existed” at the time Lieb forensically imaged 
Ridley’s alleged OneDrive folder on January 25, 2022, “but for the fact that Ridley deleted [that] 
folder from his Ecolab OneDrive after downloading [that] folder and [its] contents to the LaCie 
drive” between May 22 and July 1, 2021. Ex. 2 {| 13, 45. The underlying assumption is that the 
image Lieb obtained from the paralegal’s hard drive on January 25, 2022, is in fact an image of 
Ridley’s OneDrive folder, and that the contents of the folder remained intact and unchanged 
between the time of Ridley’s departure from Ecolab on July 1, 2021, and January 25, 2022. Ex. 1 
at 94:9-96:11, 97:2-23. As Lieb admitted, he has no basis for this assumption. Jd. at 97:2-23. 
Accordingly, his opinions lack a “logical foundation” “based on what is known.” Brown, 2020 WL 


13173275, at *10. 
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Third, Lieb fails to “consider other possible causes” of the file discrepancies that led him 
to conclude that Ridley deleted Ecolab files before he resigned—yet another “[rJed flag” that 
weighs against admissibility. Newell Rubbermaid, 676 F.3d at 528. The evidentiary record reflects 
that at least three other Ecolab employees had access to Ridley’s OneDrive files before his 
departure on July 1, 2021, that others gained access after his departure, and that a document 
preservation notice for Ridley’s data was not issued until many months later, in January 2022— 
the same month Lieb collected from an Ecolab paralegal’s computer the folder on which he bases 
his opinions. Ex. 13; Ex. | at 148:13-149:9; Ex. 14 at 222:17-24; Ex. 8 at 102:8-11, 136:13-21. 
Given the seven-month gap between Ridley’s resignation and Lieb’s creation of a forensic image 
of the folder on the paralegal’s hard drive, the number of people with access to Ridley’s OneDrive 
files, and the absence of any instruction to Ecolab’s employees to preserve the data, there are a 
number of “other possible causes,” Newell Rubbermaid, 676 F.3d at 528, for the discrepancies 
between the files seen in the folder, and the files listed on the DLP Report between May 22 and 
July 1, 2021. Yet Lieb did not consider any alternative explanations for the “missing” files before 
concluding Ridley deleted them. Ex. 2 at 10. 

The Court should exclude Lieb’s OneDrive deletion opinions because they amount to mere 
“subjective belief and unsupported speculation.” Brown, 2020 WL 13173275, at *10. 


il. LIEBCANNOT OFFER OPINIONS REGARDING STATE OF MIND OR 
INTENT. 


A defendant’s “state of mind .. . is subjective and not based upon facts or data,” such that 
“any [expert] opinion as to [the defendant’s] subjective knowledge or state of mind is speculative 
and must be excluded.” Little v. City of Morristown, 2023 WL 2769446, at *3 (E.D. Tenn. Mar. 
31, 2023); see also, e.g., Yancey v. Carson, 2007 WL 3088232, at *6 (E.D. Tenn. Oct. 19, 2007) 


(holding that experts “shall not be allowed to testify as to . . . [a defendant’s] subjective intent, his 
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state of mind, or what motivated his action or inaction’”).° There is no dispute that Lieb offers state 
of mind opinions. Ex. | at 243:1-7 (“I use the word ‘intent’ there and that is... my opinion as to 
why he stole those files.”). Courts routinely exclude this type of testimony where there is “no 
reason to believe that [the witness’s] expertise affords him the ability to read minds.” Hershey v. 
Pacific Inv. Mgmt. Co. LLC, 697 F. Supp. 2d 945, 949 (N.D. Ill. 2010) (expert’s testimony 
regarding “inten[t] to manipulate” prices and the reasons for “institut[ing] position limits” 
inadmissible); Little, 2023 WL 2769446, at *3 (holding expert’s testimony regarding officers’ 
intent was inadmissible because “intent is subjective’’). “[N]othing currently before the Court” 
demonstrates that Lieb has the training, experience, qualifications, or “compete[nce] to opine on 
the mental states of others.” Hershey, 697 F. Supp. 2d at 949. 

Lieb opines on Ridley’s state of mind no less than eight times. See supra at 8; e.g., Ex.2 
24 (“It is my opinion that Ridley exfiltrated the many Ecolab files documented in this report 
specifically to utilize them while employed at ChemTreat.”). The Court should preclude Lieb from 
offering these state of mind opinions. See Yancey, 2007 WL 3088232, at *6. 

Moreover, by concluding that Ridley “exfiltrated” Ecolab documents, which Lieb equates 
with “theft,” the majority of Lieb’s opinions incorporate a state of mind determination and opinion. 
Lieb renders a “strongly held opinion that Ridley exfiltrated thousands of Ecolab files.” Ex. 2 
{§ 12, 41, 56. Lieb did not define “exfiltrate” in his report, but testified that: 

It’s a—a forensic term meaning taken up — copied to an external USB drive that a 

former employee will take with them to use in their own company that they 

establish, or a competitor, sent to — any document activity copying, moving to — 


from a company-owned device or account for purposes of being used for 
themselves or another company. 


> The Sixth Circuit has also excluded expert opinion about the defendant’s intent on the basis of 
relevance, explaining that “no expert testimony is truly needed on the question of intent.” Superior 
Prod. P’ship v. Gordon Auto Body Parts Co., 784 F.3d 311, 324 (6th Cir. 2015). 
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Ex. | at 198:19-199:2. By this definition, Lieb’s use of the term “exfiltrate” is, itself, an improper 
opinion about Ridley’s state of mind. Each time Lieb opines that Ridley “exfiltrated” various files, 
he is saying that Ridley took those files “for purposes of’ using them to gain a competitive 
advantage for himself or for ChemTreat. /d. Lieb has no basis to opine on why Ridley allegedly 
downloaded various files. An actual “forensic analysis,” like Lieb’s purported analysis, is limited 
to what happened. Lieb’s use of “exfiltrate” to reflect intent and motive does not fall within the 
purview of a proper forensic analysis. See Little, 2023 WL 2769446, at *3. 

Each of Lieb’s opinions regarding Ridley’s alleged “exfiltration” should be excluded. See 
Ex. 2 4 12, 14, 24, 39, 41, 49, 50, 56, 59, 60. 

IV. LIEB CANNOT OFFER LEGAL OPINIONS. 

An expert’s legal opinions fail Rule 702’s most basic test: They are “not relevant . . . in the 
sense that [they] will not assist the jury,” Brown, 2020 WL 1313275, at *9, either “in understanding 
the evidence or in determining a factual issue.” Okland Oil Co. v. Conoco Inc., 144 F.3d 1308, 
1328 (10th Cir. 1998). “Although an expert’s opinion may embrace an ultimate issue to be decided 
by the trier of fact,... the issue embraced must be a factual one.” Berry, 25 F.3d at 1353. 
“Opinions are inadmissible as legal conclusions when they weigh the evidence, find the facts, 
apply the law as the expert sees it, and resolve the case. These opinions do not assist the jury; 
rather, they supplant the jury.” Brown, 2020 WL 13173275, at *9. “[P]articularly suspect” are 
“carefully couched” opinions that “merely [tell] the jury what result to reach.” Berry, 25 F.3d at 
1353-54. 

Lieb concludes “that Ridley misappropriated thousands of Ecolab files.” Ex. 2 § 14. 
Misappropriation is a term of art defined by the DTSA and TUTSA. 18 U.S.C. § 1839(5); Tenn. 
Code Ann. § 47-25-1702(2). “It is the responsibility of the court, not testifying witnesses, to define 


legal terms” such as misappropriation. Berry, 25 F.3d at 1353; see also Caudill Seed & Warehouse 
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Co., Inc. v. Jarrow Formulas, Inc., 2019 WL 1435934, at *3—*4 (W.D. Ky. Mar. 29, 2019) 
(precluding expert testimony on ultimate issue of whether alleged trade secrets were generally 
known or readily ascertainable); Proofpoint, Inc. v. Vade Secure, Inc., 2021 WL 2383574, at *1— 
*2 (N.D. Cal. June 10, 2021) (precluding expert testimony on ultimate issue of misappropriation). 
The Court should therefore preclude Lieb from opining on whether Ridley and ChemTreat engaged 
in misappropriation. 

Lieb also cannot do indirectly that which he cannot do directly. Even where Lieb omits the 
term “misappropriate,” his opinions are a thinly veiled attempt to suggest an answer on this 
ultimate issue by swapping out the word “misappropriated” with “exfiltrated.” During his 
deposition, Lieb equated “misappropriation” with “theft,” after earlier defining “exfiltration” as 
“theft.” Ex. 1 at 203:15-16, 204:20-23. Lieb cannot mask his legal conclusions by using a synonym 
for misappropriation—exfiltration—and claiming this synonym as “[his] word.” /d. at 56:11-14 
(“exfiltration, that’s my word, exfiltration”); 163:22 (same); 201:5 (same); 356:13 (same). 

Lieb’s ultimate opinions that Ridley “exfiltrated” Ecolab’s information would mislead the 
jury “into adopting outright a legal conclusion proffered by an expert witness.” Berry, 25 F.3d at 
1354. The Court should preclude Lieb from opining on whether Ridley “exfiltrated” Ecolab’s 
documents.° See Summerland v. Cnty. of Livingston, 240 F. App’x 70, 81 (6th Cir. 2007) (striking 
expert report “riddled with legal conclusions”). 


V. LIEB’S REBUTTAL OPINIONS ARE MISLEADING AND UNFAIRLY 
PREJUDICIAL. 


In his rebuttal report, Lieb claims three sources of information are “conspicuously absent” 


° Even if a legal conclusion could, in theory, assist the jury in reaching its factual findings, it is 
undisputed that Lieb—who is not a lawyer and has no legal training, expertise, or experience of 
any kind—is not qualified to render such opinions. 
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from Vaughn’s Report: (1) “the forensic imaging and analysis of Ridley’s colleagues’ ChemTreat 
workstations”; (2) “ChemTreat network stored backups of Ridley’s wiped ChemTreat 
workstation”; and (3) “the forensic imaging and analysis of Ridley’s personally owned devices 
and accounts.” Ex. 3 31-37. 

Lieb does not explain what basis he has to believe these repositories even exist—an 
obviously fatal flaw in the foundation of his opinion that they should have been searched, as Lieb’s 
criticisms, whatever they are, must be fairly grounded in the evidence. To the extent Lieb intends 
to opine that Vaughn should have analyzed these supposed sources based on Lieb’s speculation 
about their existence or contents, the Court should exclude his opinion under Federal Rule of 
Evidence 403. It is likely to mislead the jury and its admission would unfairly prejudice 
ChemTreat. “Expert evidence can be both powerful and quite misleading because of the difficulty 
in evaluating it. Because of this risk, the judge in weighing possible prejudice against probative 
force under Rule 403 . . . exercises more control over experts than over lay witnesses.” Daubert, 
509 U.S. at 595. The Court may exclude expert testimony under Rule 403 when the opinions 
relied on or pointed to facts “that d[id] not appear to be in evidence.” Biedermann Techs. GnbH 
& Co. KG v. K2M, Inc., 2022 WL 3337792, at *1—*2 (E.D. Va. July 8, 2022). 

Notably, ChemTreat detailed the repositories and custodians it searched in discovery in its 
ESI Report, Doc. 143, and Plaintiffs did not challenge the scope of ChemTreat’s search. See 
generally Fed. R. Civ. P. 26(b). Any testimony Lieb could offer about what information would be 
available had Plaintiffs sought additional evidence in discovery necessarily would be pure 
conjecture. Allowing an expert to speculate about what other evidence may or may not exist, and 
in particular what it may or may not show, would impermissibly “create[] an ‘aura of reliability’ 


tending to mislead the jury.” Moisenko v. Volkswagenwerk Aktiengesellschaft, 198 F.3d 246 (6th 


23 


Case 1:22-cv-00050-TRM-SKL Document 258 Filed 05/25/23 Page 27 of 30 PagelD #: 
6540 


Cir. 1999) (table).’ The Court should exclude Lieb’s rebuttal opinions to the extent he suggests 
that additional data repositories exist or opines as to the possible contents of such repositories. 
CONCLUSION 
ChemTreat requests that the Court exclude Lieb’s opinions related to: (1) the DLP Report 
and CrowdStrike log; (2) Ridley’s alleged deletion activity within his Ecolab OneDrive folder; (3) 
Ridley or ChemTreat’s intent or state of mind; (4) the use of terminology suggesting a legal 
conclusion, such as “misappropriation” or “exfiltration”; and (5) speculation regarding the 


existence or content of any data repositories not produced in discovery. 


DATED: May 25, 2023 Respectfully submitted, 


/s/ Troy C. Homesley 

Vidya Atre Mirmira (admitted pro hac vice) 
William T. Burke (admitted pro hac vice) 
Juli Ann Lund (admitted pro hac vice) 
Troy C. Homesley (admitted pro hac vice) 
WILLIAMS & CONNOLLY LLP 

680 Maine Ave. SW 

Washington, DC 20024 

Telephone: (202) 434-5000 

Facsimile: (202) 434-5029 

E-mail: vmirmira@wc.com 

E-mail: wburke@wc.com 

E-mail: jlund@wce.com 

E-mail: thomesley@wc.com 


W. Scott Sims 

Michael R. O’ Neill 

SIMS FUNK PLC 

3322 West End Ave. #200 
Nashville, TN 37203 


7 Although the Court previously indicated that Plaintiffs could cross-examine Vaughn “regarding 
why, for example, he did not search any standalone devices other than those belonging to Ridley,” 
Doc. 223 at 12, it left open the question now before it: Whether Lieb may offer expert opinions on 
the existence and content of repositories Plaintiffs chose not to seek in discovery, id. at 15. 
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E-mail: ssims@simfunk.com 
E-mail: moneill@simsfunk.com 


Attorneys for Defendant ChemTreat, Inc. 
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David J. Walton (pro hac vice) (423) 267-5032 — fax 
Edward G. Winsman (pro hac vice) lpope@pbsjlaw.com 
Kathleen Laubenstein (pro hac vice) jcothern@pbsjlaw.com 
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100 N. 18th Street 

Philadelphia, PA 19103 
dwalton@fisherphillips.com 
ewinsman@fisherphillips.com 
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Pavneet Uppal (pro hac vice) 

FISHER & PHILLIPS LLP 
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Phoenix, AZ 85012 
puppal@fisherphillips.com 


James Michael Honeycutt (pro hac vice) 
FISHER & PHILLIPS LLP 

227 West Trade Street, Suite 2020 
Charlotte, NC 28202 
jhoneycutt@fisherphillips.com 
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/s/ Troy C. Homesley 
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